CloudLabBox
Try the free demo

Linux for network engineers lab 2 of 14

Linux as a router: forwarding, static routes and policy routing

A Linux box replaces the depot's router. You turn on forwarding, send one PC and one application out through a second ISP with `ip rule`, find out why the replies vanish, and fit a backup default route.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then Linux for network engineers guided labs, then 02 - Linux as a router - forwarding static routes and policy routing

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 65 minutes
Nodes need
6 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

The Hull depot's router has died and there's no budget for another. RTR is a Linux box with three ports: the depot LAN, ISP-A and ISP-B. Task 0 applies the team's hardening baseline, which includes strict reverse-path filtering. Most traffic should use ISP-A. The CCTV PC, H2, uploads footage that must go out through ISP-B, and so must the billing application on TCP 443.

DeviceInterfaceAddressRole
H1, H2eth010.2.10.10, 10.2.10.20 /24depot PCs, gateway 10.2.10.1
RTReth010.2.10.1/24depot LAN
RTReth110.2.1.2/30to ISP-A (R1 .1)
RTReth210.2.2.2/30to ISP-B (R2 .1)
R1, R2Gi0/110.2.99.1, 10.2.99.2 /24head office network
SRVeth010.2.99.50/24head office server, gateway R1
DeviceRunsHow to log in
H1, H2, SRVAlpine Linux 3.20root, no password.
R1, R2Cisco IOSv 15.9The console opens at >; enable has no password.
RTRAlpine Linux 3.16 with iptables and iproute2Opens on a menu: press 5, then Enter, for a root shell.

What you’ll practise

  • Turn on IPv4 forwarding at run time and permanently
  • Add static routes and prove the path with traceroute
  • Build policy routing with ip rule and a named table
  • Explain and tune reverse-path filtering
  • Route by protocol and port
  • Fit a floating default route and see what a link failure removes

The tasks

  1. Start the Linux nodes
  2. Turn on forwarding
  3. Point the depot at ISP-A
  4. Send the CCTV PC out through ISP-B
  5. Find out why the replies vanish
  6. Route by application
  7. Add a backup default route

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Linux as a router - forwarding static routes and policy routing6 nodes and 2 networks, 8 links. Every link is listed as text below the diagram.H1H2SRVR1R2RTRLANHQeth0eth0eth0eth0Gi0/1Gi0/1eth1Gi0/0eth2Gi0/0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • H1 eth0 to LAN (network)
  • H2 eth0 to LAN (network)
  • RTR eth0 to LAN (network)
  • RTR eth1 to R1 Gi0/0
  • RTR eth2 to R2 Gi0/0
  • R1 Gi0/1 to HQ (network)
  • R2 Gi0/1 to HQ (network)
  • SRV eth0 to HQ (network)
Nodes in Linux as a router: forwarding, static routes and policy routing, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
SRVAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
RTRAlpine WAN emulatorclbalpinewanem-alpine-3-16-2-wanem1 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Linux for network engineers guided labs.

  3. Open 02 - Linux as a router - forwarding static routes and policy routing and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Linux for network engineers labs

All Linux for network engineers labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, the Linux Foundation and the Linux Professional Institute. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.